Source-linked AI summary
Phantom Navigator: Stealthy and Precise Unmanned Aerial Vehicle Redirection with Real-Time Tracking and GPS Spoofing
Haocheng Meng, Shaocheng Luo, Songqiao Xie, Miroslav Pajic
TL;DR
Existing UAV redirection attacks lack the precision, reliability, and covertness needed to steer drones to attacker-chosen destinations. Phantom Navigator combines pre-attack reachability analysis with real-time closed-loop GPS spoofing and tracking. Physical evaluations validate precise and reliable redirection indoors and outdoors, while the approach’s tracking remains constrained by sensing range and can drift during prolonged measurement loss.
Problem
Existing UAV redirection attacks do not reliably and covertly divert drones to attacker-chosen destinations without triggering anomaly detection.
Method
Phantom Navigator combines pre-attack redirection-range analysis, a lightweight closed-loop controller, and LiDAR–camera tracking for targeted GPS spoofing.
Results
Physical-platform evaluations validate precise and reliable redirection in indoor and outdoor environments.
Takeaways & Limitations
The framework provides a stealthy, targeted redirection capability using attacker-side tracking and GPS spoofing.
Takeaways & Limitations
Tracking is constrained by LiDAR and camera sensing range and resolution, while prediction-only operation may drift during prolonged sensory loss.
Abstract
from arXiv · showhide
Redirecting unmanned aerial vehicles (UAVs) from their intended mission trajectories has been an active area of research. However, existing UAV redirection attacks lack reliability, precision, and covertness for a targeted diversion. They primarily rely on physical capture, communication hijacking, or sensor spoofing. Yet, physical interception is costly, offers only a single opportunity for success, and poses a high risk of collateral damage; network-based attacks demand deep technical expertise and access to encrypted communication channels; and sensor spoofing techniques typically fall short in achieving the accuracy and robustness required to steer a UAV toward a specified target. Consequently, we propose Phantom Navigator, a UAV redirection attack to mislead drones to a designated spoofing target, covertly and precisely. Our approach combines offline pre-redirection reachability analysis, which provides high-fidelity estimates of achievable redirect ranges, with an online closed-loop, stealthy execution layer that ensures successful redirection in practice. Based on this approach, we build a physical attack platform equipped with a LiDAR--camera detection, tracking, and spoofing stack that performs real-time identification, pose estimation, and computation of targeted spoofing signals to covertly and accurately redirect victim UAVs to a designated location. We demonstrate the effectiveness of our redirection methodology and the attack implementation in real-world case studies.
1 Introduction
UAVs depend heavily on GPS navigation, yet existing redirection attacks do not reliably and covertly steer them to attacker-chosen destinations. Phantom Navigator addresses this gap through offline reachability analysis and online closed-loop spoofing with real-time tracking.
- UAV missions depend on onboard GPS for localization, planning, and autonomous execution, making navigation integrity critical.
- Existing redirection methods include wireless hijacking and sensor spoofing, but hijacking requires difficult access to communication or control interfaces.
- Prior GPS-spoofing attacks generally lack both precise control of the spoofing outcome and strategies for evading onboard anomaly detection.
- Open-loop or human-supervised methods are unreliable for accurate target redirection, while prior closed-loop radar-aided attacks are easily detectable.
- Phantom Navigator combines offline attack-range estimation with online closed-loop execution to redirect UAVs precisely and covertly without assuming internal parameters or sensor-fusion details.
2 Related Work
Related work spans multimodal UAV detection and physical GPS spoofing. The paper positions LiDAR–camera fusion and controlled GPS manipulation as practical components for targeted redirection.
- UAV detection and tracking: Radar supports long-range UAV detection, while cameras provide identification but degrade under poor lighting, fog, or occlusion.
- UAV detection and tracking: LiDAR enables three-dimensional localization and tracking with resilience to lighting conditions, and multimodal fusion improves robustness and reliability.
- GPS spoofing: GPS spoofing forges satellite signals so receivers compute false positions or time, enabling systematic rerouting through counterfeit signals.
- GPS spoofing: Overshadow attacks overpower legitimate GPS signals and are easy to detect because abrupt receiver changes can cause sudden satellite-lock loss.
3 Threat Model
The threat model considers a stationary, lightweight attacker that tracks a victim UAV, estimates its GPS noise, and emulates spoofing effects at the cyber level. The objective is precise, covert diversion to a selected target.
- The attacker seeks to detour a UAV to a desired location while remaining covert to onboard anomaly detection.
- The attacker uses a stationary lightweight platform rather than the heavy fixed-groundstation assumptions common in prior work.
- The platform detects, identifies, and tracks the victim through LiDAR–camera fusion, estimates GPS noise characteristics, and emulates spoofing effects cyber-level.
4 UAV Redirection Methodology
Phantom Navigator combines offline reachability-based range estimation with online closed-loop GPS manipulation to redirect UAVs precisely while preserving stealthiness. The methodology models GPS-only redirection, formalizes detector-agnostic stealthiness, calibrates an enforceable spoofing bound, and verifies conservative target-region estimates.
- Framework overview: Phantom Navigator uses attacker-side tracking, redirection-range estimation, and closed-loop GPS-only control to achieve precise, stealthy UAV diversion.The framework is designed to operate without assumptions about internal parameters or the victim’s sensor-fusion pipeline.
- Stealthiness guarantees: Stealthiness is defined by keeping attacked detector-visible observations statistically close to nominal observations under a KL-divergence threshold.The detector observes state-induced mismatch rather than the spoofing input directly, so bounded deviation limits the attack’s statistical footprint.
- GPS-only redirection mechanism: GPS spoofing alters the victim’s believed navigation state, causing the autopilot to close the loop on corrupted but internally consistent measurements.The model isolates translational motion and represents spoofing through position and velocity offsets that produce accumulated drift.
- Stealthiness guarantees: The calibrated spoofing bound λ_a approximates the largest GPS-only perturbation whose detection probability remains consistent with the nominal false-alarm rate.λ_a depends on the victim’s GPS noise profile; noisier measurements permit larger stealthy perturbations.
- Redirection range estimation: Reachability analysis approximates feasible redirection regions by taking the convex hull of sampled input-sequence trajectories under the stealthy input set.Each sampled sequence generates a candidate path, while the convex hull provides an efficient outer approximation of reachable states.
- Partial information refinement and verification: More mission information produces less conservative range estimates, and MATLAB/Simulink verification shows increasingly precise conservative boundaries that define reliably reachable target regions.Across destination, trajectory, and motion-planning knowledge levels, any target inside the estimated boundary is reliably reachable under the assumed constraints.
4.3 Real-time Closed-loop UAV Redirection
Phantom Navigator uses real-time closed-loop feedback to steer UAVs toward chosen targets while constraining spoofing perturbations for stealthiness. Simulation across line, zig-zag, and circular missions shows target-oriented redirection while the believed trajectory remains near the nominal path.
- Controller operation: The controller updates spoofed GPS position and velocity from tracked victim state and the desired target.It operates as a real-time closed-loop redirection mechanism after feasible redirection ranges are estimated.
- Controller operation: The lightweight controller works directly in GPS measurement space without access to the victim’s internal control stack.This design matches the black-box GPS-only threat model.
- Controller operation: The attacker estimates victim position and velocity, computes target-relative errors, and maps them to a target-oriented spoofing acceleration.The feedback law uses position and velocity errors relative to the desired target.
- Stealthiness enforcement: Spoofing acceleration is clipped to the admissible bound 𝜆_a while preserving its direction, then integrated into spoofed velocity and position states.The resulting spoofed states are injected into the victim’s GPS outputs.
- Implementation: The attacker platform combines LiDAR–camera detection and tracking with spoofing capabilities for the full-stack implementation.YOLOv5 supplies camera detections, LiDAR processing contributes three-dimensional observations, and a Kalman filter estimates real-time position and velocity.
- Evaluation: Simulation on single-line, zig-zag, and circular missions drives true trajectories toward the target while keeping believed trajectories close to nominal paths.Figure 4 reports redirection acceleration norm, CUSUM, and 𝜒2 anomaly detector statistics for the three trajectories.
5 Real-world Redirection Study
The real-world study implements Phantom Navigator with a LiDAR–camera tracking and spoofing platform, then evaluates targeted redirection, precision, latency, and anomaly-detection stealthiness indoors and outdoors.
- Implementation: The attacker platform combines an Intel NUC, RealSense D435i camera, and Livox Mid-360 LiDAR for victim detection, tracking, pose estimation, and spoofing.The tracking hub uses camera images, LiDAR point clouds, and a Kalman-filter tracker to estimate victim position and velocity.
- Computation Overhead: 265.9 ms average end-to-end latency and 613.4 ms 95th-percentile latency include tracking and attacker-to-victim transmission.YOLO-based identification runs asynchronously at 288.6 ms average latency without blocking the main attack pipeline.
- Indoor Redirection: 0.125 m mean redirection error with 0.107 m standard deviation was achieved across ten randomized indoor target destinations.Accuracy fluctuations were attributed to differing tracker modes and sensing-source availability.
- Indoor Stealthiness: 0.005% χ2 and zero CUSUM detection rates were observed across ten indoor attack trials.Threshold-normalized detector statistics remained below the alarm boundary under attack.
- Outdoor Evaluation: Tracker-mode switching, temporary tracking losses, and transmission drops caused occasional trajectory irregularities, but guidance resumed after perception recovery.After reaching the target, the victim continued according to mission logic based on its corrupted navigation state.
- Outdoor Evaluation: 0.476 m mean outdoor redirection error and 0.351 m standard deviation were measured with real GPS data.Outdoor aggregate detection rates were 0.08% for χ2 and 0.00% for CUSUM despite sensing and environmental variability.
6 Discussion and Conclusion
Phantom Navigator uses attacker-side tracking and GPS spoofing to redirect UAVs precisely and stealthily, while remaining robust to intermittent tracking degradation. The discussion identifies sensing-range limitations and possible extensions and defenses.
- Conclusion: Phantom Navigator characterizes achievable redirection capacity through pre-attack analysis and uses a lightweight controller based on target and estimated victim position.The controller is designed to remain robust against intermittent tracking degradation.
- Conclusion: Physical-platform experiments validate precise and reliable redirection in both indoor and outdoor environments.
- Real-world Cases: Outdoor experiments demonstrate lateral, halting, and turn-back redirection against a moving victim UAV, with two trials for each type.
- Limitations: The tracking pipeline is constrained by camera and LiDAR sensing range and resolution, while prolonged sensory loss can cause prediction-only filter drift.
- Defenses: RTK-GPS, environmental semantics, and collaborative sensing are proposed as defenses or improvements for limiting spoofing and identifying compromised localization sources.
A.1 Modeling Vehicle Physical Dynamics
The appendix models UAV translational and rotational physical dynamics using standard nonlinear quadcopter equations, including thrust, drag, inertia, angular velocity, and torque.
- Translational Dynamics: The UAV physical model represents translational motion with a standard Euler–Newton equation.
- Translational Dynamics: The translational model includes collective thrust applied at the center of mass and aerodynamic drag in the Earth frame.
- Translational Dynamics: The drag terms use coefficients for the coordinate directions and Earth-frame velocities.
- Rotational Dynamics: Rotational motion is modeled using body-frame angular velocity, a skew-symmetric matrix operator, inertia matrix, and total body-frame torque.
A.2 GPS Spoofing Effect Formulation
The GPS spoofing formulation models genuine GPS position and velocity measurements with noise, then adds spoofing offsets that bias sensor-fusion state estimates while leaving IMU measurements uncompromised.
- GPS Measurements: GPS provides direct Earth-frame position and velocity measurements in the UAV sensor-fusion configuration.
- GPS Measurements: The measurement model represents true position and velocity with zero-mean Gaussian GPS noise.
- Spoofing Model: GPS receivers are modeled as locking onto counterfeit signals whose offsets are added to original sensor readings.
- Spoofing Model: Spoofing signals add offsets to position and velocity, biasing GPS output and producing incorrect sensor-fusion state estimates.
- Assumption: The formulation assumes uncompromised IMU measurements while GPS-only manipulation can still spoof UAV position stealthily.
A.3 Simulation Setup
The MATLAB/Simulink offline verification uses simulator configurations, redirection-command settings, a drone physical model, and noise profiles.
- Table 3 specifies the simulation parameters used for MATLAB/Simulink offline verification.These include simulator configurations, redirection-command setup, the drone physical model, and noise profiles.
A.4 Redirection under Tracker Loss
The LiDAR–camera tracker was tested under intermittent target loss, including losses before and after redirection began. Despite large tracking errors, the controller coherently diverted the victim drone without significant impact.
- Intermittent tracker loss occurred both before and after redirection began, producing very large tracking errors.
- Despite tracker loss, the redirection controller was not significantly impacted and diverted the victim drone coherently.The result demonstrates robustness to intermittent tracking errors.
- Figure 13 reports the redirection result in the X-axis under intermittent tracker loss with a recovered redirection command.